Experimental Eavesdropping Attack against Ekert's Protocol based on Wigner's 

Inequality 
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We experimentally implemented an eavesdropping attack against the Ekert protocol for quantum 
key distribution based on the Wigner inequality. We demonstrate a serious lack of security of this 
protocol when the eavesdropper gains total control of the source. In addition we tested a modified 
Wigner inequality which should guarantee a secure quantum key distribution. 



Quantum key distribution (QKD) provides a method 
for distributing a secret key for unconditional secret com- 
munications based on the " one time pad" because it guar- 
antees that the presence of any eavesdropper compromis- 
ing the security of the key is revealed. For a review on 
this topic see 

The first protocol for QKD has been proposed in 1984 
by Bennett and Brassard [2| , the worldwide famous BB84 
protocol. In 1991 A. Ekert proposed a new QKD protocol 
whose security relies on the non-local behavior of quan- 
tum mechanics, i.e., on Bell's inequalities Q. 

Several groups around the world implemented and 
tested QKD systems based on variants of the BB84 pro- 
tocol using either faint laser 0, IH IS S H or entangled 
photons JXL, XL, jLi, J^, while, to our knowledge, 
only recently two groups implemented the Ekert's proto- 
col [l^ IT^ . In particular Naik et al. (I^ implemented a 
variant of the Ekert's protocol based on Clauser-Horne- 
Shimoiiy-Holt (CHSH) inequality as proposed in Ekert's 
paper l3|, and Jennewein et al. |l2l | implemented the 
Ekert's protocol based on the Wigner inequality. 

In ref. |0| the Wigner inequality was first proposed to 
provide an easier and equally reliable eavesdropping test 
as the CHSH when the Ekert protocol is implemented. 
The necessary security proof of the Ekert protocol based 
on the Wigner inequality consists in verifying the viola- 
tion of > 0. 

To obtain the Wigner inequality {W > 0) it is nec- 
essary to review the Wigner argument jl2|. Two main 
assumptions are stipulated in the proofs of the Wigner 
inequality: locality and realism. Locality means that Al- 
ice's measurements do not influence Bob's measurements, 
and vice versa. Realism means that, given any physical 
property, its value exists independently of its observation 
or measurement. The counterpart of the local- realistic 
theories is the non-locality behavior of quantum mechan- 
ics, a signature of quantum entanglement. In particular 
Wigner considered a quantum system prepared in the 
singlet state, and he obtained the violation of the in- 



equality 14^ > 0, i.e. , W = —0.125. Furthermore, in the 
derivation of his inequality, Wigner assumed perfect anti- 
correlation in the measurement results. This assumption 
is obviously reasonable in the test of realism and locality 
of a physical theory (it reflects the classical counterpart 
of a quantum system prepared in the singlet state). Nev- 
ertheless, in terms of QKD this assumption corresponds 
to a lack of security. 

In fact, when the eavesdropper. Eve, measures photons 
on either one or both of Alice and Bob channels, her 
presence should be revealed by a higher value of W than 
the local-realistic theories Jimit W — 0, as it happens 
for the CHSH inequality y. Unfortunately this is not 
the case. In fact, only when Eve adopts an intercept- 
resend strategy and detects one photon of the pair, the 
inequality becomes W > 0.0625, but, as we will show, 
this is not for eavesdropping on both channels, because 
in this case there is no limit |l(il |. 

In this letter we perform an experiment proving the 
weakness of the Wigner inequality as a security test for 
QKD, under the condition of Eve gaining total control 
of the source of photon pairs. Under this condition, she 
prepares each particle of the pair separately in a well de- 
fined polarization direction, in other words she prepares 
the photon in Alice's channel in the state and the 

photon in Bob's channel in the state |(/>_b), respectively 

10a) = cos4>a\Ha) +s\n(j)A\VA) , 

\(t)B) = COS(j)B \Hb) + sin (j)B\VB) ■ 

Thus Eve has a perfect knowledge of the polarization of 
the photons sent and, even if the non-local behavior of the 
original quantum system (the singlet state) is completely 
removed, we prove that she can avoid disclosing herself. 

We remind the reader that ref. 0| presented a mod- 
ified version of the Wigner's parameter W which main- 
tains the same limits, i.e. , > for local realistic the- 
ories and W = — 0.125jor the singlet state, but allows 
secure QKD, because W contains the additional term 
accounting for the anticorrelation. In our experiment we 
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FIG. 1: Contour-plot of W (a) and W (b) versus (j)A and 
(l>B- Inset shows the regions where W < —0.125 (black), 
-0.125 <W < (dark grey), < WiW) < 0.0625 (light 
grey), W{W) > 0.0625 (white). 



also measure W and we observe that the minimum of 
W is well above the limit for local-realistic theories in 
agreement with the theory ensuring a secure QKD. 
The measured quantities in our experiment are W and 

w [13, respectively 
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where PaA,aB{^A,yB) are the probabilities of detecting 
the pair of photons by the couple of detectors xa, Vb 
{xa = +At~a and ub = +b,—b) when in the detec- 
tion apparatuses two half-wave plates (HWPs) project 
photons in the polarization bases 

\saj = cosa^ -I- sina^ |Vj) , 
|s^J = sina^ lif^) - cosQ!^ |Vj) , 



FIG. 2: QKD set-up with the source of photon pairs under 
Eve's control: photon pairs are generated by SPDC in a type I 
nonlinear crystal (NLC2) pumped by the pulsed laser system 
(LD, Ti:Sa and NLCl). The polarization state of the photons 
is controlled by half- wave plates (HWPs) and selected photons 
are directed to the Alice and Bob detection apparatuses com- 
posed of HWPs, interference filters (IF) fiber couplers, fibers 
integrated polarizing beam splitters (PBS), single-photon de- 
tectors. M mirror, DM dichroic mirror, L lens 



with z = A,B. In formula 

Pqa.obI+A, +s) = \{<l>A\SaA) {4>B\SaB)\^ 

PaA,aBi + A,-B) = | | Sa a) (0B | S ) | ^ 

PaA.aBi-A,+B) = | | A ) (0S | Sq b) | ^ 

PaA,aBi-A,-B) = | (^A a) (^B s) f • (3) 

In Fig. 1 (a) and (b) we present the calculated contour 
plots of W and W versus the polarization directions (pA 
and (pB oi the photons of the pair senl^y Eve. Highest 
values of W and W {max{W) ~ max{W) ~ 0.9557) cor- 
responds to the center of white regions of Fig. s 1. Darker 
regions correspond to lower range of values for W and 
W. 

The values min{W) ~ —0.2121 are in the middle of 
black regions of Fig. 1 (a) along "Fig. 3 (a)" line, 
while min{W) ~ 0.0443 are almost in the middle of 
dark grey regions of Fig. 1 (b). The straight lines for 
(f>B — 0°,62°,98° represent sections of the plots where 
the theoretical predictions are compared with the exper- 
imental results of Figs. 3 (a), (b) and (c). 

In Fig. 2 we depict the experimental scheme consid- 
ering the situation in which Eve has total control of the 
source. In this scheme, the source under Eve's control 
replaces the source of entangled photon pairs of a typical 
QKD scheme [H [H E iH [H. Eve's source is ob- 
tained by a 1 mm length LilOs nonlinear crystal (NLC2) 
pumped by ultrashort pulses (150 fs) at 415 nm gen- 
erated from a second harmonic (obtained from NLCl) 
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of a ultrashort mode-locked Ti-Sapphire with a repeti- 
tion rate of 76 MHz pumped by a 532 nm green laser. 
The NLC2 realizes a non-collinear type I phase matching 
and Eve selects two quantum correlated optical chan- 
nels along which the twin photons at 830 nm (emitted at 
3.4°) are sent towards Alice and Bob's detection appa- 
ratuses 0, 01 . The down-converted photons of a pair 
have the same polarization state (ordinary waves) and 
Eve can modify deterministically the polarization state 
of the photon by means of a half-wave-plate (HWP) in 
each channel, in other words Eve sends photon pairs to 
Alice and Bob with polarization state \(j)A) and \(j)B)^ re- 
spectively. 

Alice and Bob's detection apparatuses are identical 
and are composed of an open air-fiber coupler to collect 
the down-converted light by single- mode optical fibers. 
The detection of photons in the proper polarization ba- 
sis is guaranteed by a HWP before the fiber coupler and 
a fiber-integrated polarizing beam splitter (PBS). Pho- 
tons at the two output ports of the PBS are sent to fiber 
coupled photon counters (Perkin-Elmer SPCM-AQR-14) 
p^. Interference filters peaked at 830 nm with 11 nm 
bandwidth are placed in front of the fiber couplers to 
reduce stray light. 

Coincident counts between any of Alice's detectors 
(-f A, —a) and any of Bob's detectors {+b, —b) are ob- 
tained from an Elsag prototype of four-channel coinci- 
dent circuit H^, 0| . Single-counts and coincidences are 
counted by a National Instruments |l9l | sixteen channels 
counter plug-in PC card. 

The terms PaA,aB {xa^Ub) are estimated in terms of 
the number of coincident counts: 



..{xA,yB) 



NaA^asi^A^VB) 



[NaA.aB{ + A,+B) + Na^^a^{ + A,-B)- 
A^QA.QB {^A, +b) + NaA.ani^'A, - b)] 

(4) 

where NaA,aBixA,yB) is the number of coincidences 
measured by the couple of detectors xa, Ub {x,y = +, ~) 
when Alice and Bob's detection apparatuses project pho- 
tons in the polarization bases at Eq.s ©. 

In Fig. 3 (a) we present our main result: photons sent 
by Eve in a definite polarization state violate the limit of 
local-realistic theories. Experimental data for W (circles) 
and W (squares) are presented versus with (pB fixed 
approximately at 62° and show a good agreement with 
theoretical predictions (lines). 

As expected from the theory 0| , not only does W vio- 
late the limit of local- realistic theories {W — 0), but also 
some data points pass the quantum limit (W = —0.125); 
while W is well above the limit of local-realistic theories. 
The theoretical curves are calculated with (pA = 62°, and 
the discrepancy between theory and experiment can be 
explained by noting the difficulties in the proper angular 
positioning of the four HWPs and in the noise introduced 
by real optical devices, e.g., fibers, PBSs, detectors dark 
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FIG. 3: Experimental data for W (squares) and W (circles) 
and theoretical curves (lines) are showed. Range of values of 
Wigner's parameter corresponding to local-realistic theories 
and quantum mechanics (Q.M.) are indicated, (a) Violation 
of the limit of local-realistic theories for W, obtained with 
(l>B ~ 62°. (b) Minimum obtainable for W obtained with 
4>B = 98°, along with violation of the limit of local- realistic 
theories for W . (c) W = W obtained with <f)B = 0°. 



counts and straylight. 

In Fig. 3 (b) we present the experimental data and the 
theoretical curve obtained with (j)B = 9§°, corresponding 
to a position close to the minima of W as predicted by 
the theory. Fig. 3 (b) shows a good agreement between 
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experimental data (circles) and theoretical predictions of 
W and the minimum of experimental values, 0.0685, is 
slightly higher than the theoretical predictions of 0.0466. 

Furthermore, Fig. 3 (b) shows also the experimental 
data for W (small squares) together with the associated 
theoretical curve, and we observe that also in this case a 
violation of the local-realistic theories limit occurs. 

According to Eq.s ^ and (0), we note that W differs 
from W only because of the term poj^.o^ (— A, —b), thus if 

Po° ,0° {—A, —b) = then W — W, and this occurs when 
(l>A = 0°, 180° or = 0°, 180°. 

In Fig. 3 (c) we consider the situation when <j)B — 0° 
and we observe that the experimental data for W (small 
circles) are almost superimposed to the W ones (squares) 
in good agreement with the theoretical prediction, W = 
W (line). 

Some further analysis of W must be considered for 
the practical implementation of the Ek ert p rotocol based 
on Wigner's inequality. According to [l^, we highlight 
that the Ekert's protocol based on modified Wigner's in- 
equality still guarantees a simplification with respect to 
the one based on the CHSH inequality, because Alice 
and Bob randomly choose between two rather than three 
bases. Though the necessity of an experimental evalu- 
ation of the term po-^fi°^{—A, —b) forces Alice and Bob 
to sacrifice part of the key for the sake of security, we 
note that in any practical implementation of QKD pro- 
tocols, Alice and Bob distill from the noisy sifted key a 
nearly noise-free corrected key by means of error correc- 
tion procedures subjected to the constraint of knowing 
the quantum bit error rate (QBER). Also, the QBER is 
estimated at the cost of losing part of the key. Thus, 
we suggest using the same sacrificed part of the key to 
estimate both W and QBER. 

To perform a proper comparison of the performances 
of Ekert protocols based on Wigner's inequality versus 
the one CHSH-based Q, it is necessary to consider sit- 
uations where the same number of analyzer settings are 
employed. In particular, we consider the modified pro- 
tocol based on Wigner inequality proposed in [3| where 
Alice and Bob measure randomly using three analyzer 
settings (as in the case of CHSH). This protocol is more 
efficient than the protocol based on CHSH. In particular, 
for CHSH only 2/9 of the qubits exchanged are devoted 
to the key generation (2|, while here we can improve till 
1/3 depending on the security needs. Furthermore in 
this protocol none of the qubits exchanged are discarded 
while in the case of CHSH 1/3 of the qubits are discarded 

In conclusion, this paper highlights the insecurity of 
Ekert's protocol based on the Wigner inequality. We 
performed an experiment simulating the total control of 
photons in Alice and Bob channels by an eavesdropper, 
proving that the QKD Ekert protocol based on Wigner's 
inequality presents a serious lack of security. In addition. 



we proved that a modified version of the Wigner security 
parameter guarantees secure QKD. 
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